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We demonstrate that the Byzantine Agreement Problem (BAP) in its weaker version with de- 
tectable broadcast, can be solved using continuous variables Gaussian states with Gaussian oper- 
ations. The protocol uses genuine tripartite symmetric entanglement, but differs from protocols 
proposed for qutrits or qubits. Contrary to the quantum key distribution (QKD) which is possi- 
ble with all Gaussian states, for the BAP entanglement is needed, but not all tripartite entangled 
symmetric states can be used to solve the problem. 
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An algorithm is commonly defined as a set of rules for 
solving a problem in a finite number of steps. One of the 
aims of Quantum Information is to provide new protocols 
and algorithms which exploit quantum resources to find 
solutions to problems which either lack a solution using 
classical resources, or the solution is extremely hard to 
implement. The term "Byzantine Agreement Problem" 
was originally coined by L. Lamport in the context of 
computer science. In a cryptographic context it refers to 
distributed protocols in which some of the participants 
might have malicious intentions and could try to sabo- 
tage the protocol inducing the honest parties to take con- 
tradictory actions between them. This problem is often 
reformulated in terms of a Byzantine army, where there 
is a lieutenant general who sends the order of attack- 
ing or retreating to each one of his lieutenants. Those 
can also communicate pairwise to reach a common de- 
cision concerning attacking or retreating, knowing that 
there might be traitors among them including the gen- 
eral. A traitor could create fake messages to try that 
different parts of the army attack while others retreat 
putting the army at a great disadvantage. The ques- 
tion is thus whether there exists a protocol among all 
the officials involved that, after its termination, satisfies 
the following conditions: The lieutenant general sends 
an order to his N — 1 lieutenants such that: (i) All loyal 
lieutenants obey the same order, (ii) If the lieutenant 
general is loyal, then every loyal lieutenant obeys the or- 
der he sends. Lamport, Shostak and Pease proved in [IJ 
that if the participants only share pairwise secure clas- 
sical channels, then Byzantine Agreement or broadcast 
(BA) is only possible iff t < n/3, where n is the number 
of players and t the number of traitors among them. In 
Q, Fitzi and coworkers introduced the important con- 
cept of detectable broadcast .and found a solution using 
quantum resources (see also Q). Detectable broadcast is 
said to be achieved if the protocol satisfies the following 
conditions: (i) If no player is corrupted, then the pro- 
tocol achieves broadcast, and (ii) If one or more players 
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are corrupted, then either the protocol achieves Byzan- 
tine Agreement or all honest players abort the protocol. 
Thus, in a detectable broadcast protocol, cheaters can 
force the protocol to abort, i.e. no action is taken, but in 
such cases all honest players agree on aborting the pro- 
tocol so contradictory actions between them are avoided. 

Here we investigate the possibility of solving detectable 
broadcast using Gaussian states and performing only 
Gaussian operations. Quantum Information with Gaus- 
sian states has become recently a very active research 
area [f| since (i) Gaussian states (e.g. photons in co- 
herent, squezeed or thermal states) are often the main 
quantum resource available in current experiments, (ii) 
in spite of the fact that they are elements of a Hilbcrt 
space of infinite dimensions they have a very compact 
and easy mathematical representation and (iii) it is de- 
sirable to classify entangled Gaussian states according 
its performance to several quantum information tasks as 
well as exploiting the differences between discrete and 
continuous variables scenario. 

The protocols using entanglement as a resource 00,0 
are based on 3 differentiated steps: (i) distribution & 
test of the quantum states, (ii) measurements of the 
distributed states to establish a primitive and (iii) 
broadcast protocol. The (iii) step is fundamentally 
classical, since it uses the outputs of the measures of 
the quantum states to simulate a particular random 
generator (primitive). In the simplest case, in which only 
3 parties are involved, traditionally denoted by S 1 , the 
sender, and the receivers Ro and R\, and at most, only 
one is a traitor, the desired primitive generates for every 
invocation, with uniform distribution, a random permu- 
tation on the elements {0,1,2}, i.e. (xSiERoiERi) <E 
{(0,1,2), (0,2,1), (1,0,2), (1,2,0), (2, 0,1), (2, 1,0)} so 
that each player i has an assigned output Xi. In this 
primitive, each player ignores how the other two values 
are assigned to the other players. Furthermore, nobody 
else (besides the parties) have access to the sequences. 
Quantum entangled states are used in the protocol 
to distribute classical private random variables with 
an specific correlation between the players, in such a 
way that any malicious manipulation of the data can 
be detected by all honest parties allowing them to 
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abort the protocol. In the discrete case such primitive 
can be implemented with e.g. Aharonov states \A) = 
^=(|0 ! 1,2) + |1,2,0)+|2,0,1)-|0,2,1)-|1,0,2)-|2,1,0)) 
which assures the distribution and test part to be se- 
cure |2|. Exploiting the fact that whenever the three 
qutrits are all measured in the same basis then all three 
results are different, the players are left -after discarding 
all the states used for the testing part- with a sequence 
of j — 1,2...L outputs schematically represented by 
the table below. We denote this quantum primitive as 
Q-ffip. 
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To implement the Q-Flip with Gaussian variables via the 
W-Flip primitive we choose a family of fully inseparable 
3-mode Gaussian states, completely symmetric under ex- 
change of the players, characterized by a single parameter 
a with covariance matrix [a: 
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After accomplishing the distribution & test part of the 
protocol, the sender S will broadcast a bit x £ {0, 1} 
(0 = "attack" , 1 = "retreat" ) to the two receivers us- 
ing classical secure channels. Following broadcasting 
(step iii) proceeds as follows: 

(111.1) : We denote by Xi the bits received by Ri (no- 
tice that if the sender is malicious, the broadcasts bits 
Xi could be different). Each receiver Ri demands to S 
to send him the indices j for which S got the result Xi. 
Each player Ri receives a set of indices Ji. 

(111. 2) : Each Ri test consistency of his own data, i.e. 
checks weather his output on the set of indices he re- 
ceives (Ji) are all of them different from Xi. If so the 
data is consistent and he settles his flag to yi — Xi. oth- 
erwise his flag is settled to yi =_L. 

(iii-3): Rq and R\ send their flags to each other. If both 
flags agree, the protocol terminates with all honest par- 
ticipants agreeing on x. 

(iii-4): If yi =_L, then player Ri knows that S is dishon- 
est, the other player is honest and accepts his flag. 
(iii-5): If both Rq and Ri claim to have consistent data 
but 2/o 7^ yij player R± demands from Rq to send him all 
the indices k S Jo for which Rq has the results I — yg. Ri 
checks now that (i) all indices k from Rq are not in J\ 
and (ii) the output R\ obtains from indices k correspond 
to the value 2. If this is the case, R\ concludes that Rq is 
honest and changes his flag to j/o- If not, R\ knows that 
Rq is dishonest and he keeps his flag to y\. Detectable 
broadcast is in this way achieved. 

Let us now introduce, analogous to the Q-flip, a bit-value 
primitive denoted by W-Flip. W-Flip is a random gen- 
erator that (for every invocation), with uniform distri- 
bution, generates a random permutation on the elements 
{1,0,0}, i.e. (x s ,x Ro ,x Rl ) e {(1,0,0), (0,1,0), (0,0,1)} 
so that each player i has an assigned opt Xi. Invoking 
twice a W-Flip permits to map bit values to the trit 
values of the Q-flip {0,1,2} according to the following 
rule:(l,0) -> 0, (0, 1) ->1, (0,0) -> 2 plus an additional 
element "Z" (1, 1) -> z. 
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where b = |(5a — y/9c 
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For a > 1 all NPT-criteria[8| are satisfied, so the state 
has genuine 3 partite entanglement. Now to transform 
quantum states into a sequence of correlated private clas- 
sical trits between the 3 players, each player measures 
the quadratures of the electromagnetic field, e.g. posi- 
tion (momentum) |ij . Denoting by Xi the corresponding 
operators, and by £i the measurement results, the play- 
ers communicate classically with each other and agree 
on only those values for which \xg\ = \x Ro \ = \%Ri\ = %o 
with xq > 0. Every player i maps Xi — +xq to the log- 
ical bit Xi — 1 and Xi = —xq to the logical bit Xi = 0. 
Notice that W-flip requires that the probabilities of the 
outputs fulfill: (i) p(100) = p(010) = p(001) = p and 
6 = p(else) <C p, (ii) p — * h and S(else) — > where 
f>{x s x Ra x Rl ) = p(x s x Ro x Rl )/(Y / p(x s x Ro x Rl ))) are the 
conditional probabilities. Using for the representation of 
the Gaussian states their Wigner function: 
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where d is a 2n real vector and 7 the covariance matrix 
probabilities are straightforwardly calculated: 

p(x s x Ro x Rl ) = Tr[p M > a j 

= (27T)™ / wif XR ° XR i(ow a (Od 2n m 



describes the disen- 



Herep M = p/ ® Prq ° ® p R > 

tangled 3 Gaussian modes obtained after each party has 
performed a measurement in its subsystem and p a is the 
initial 3 partite entangled state described by 7(a) and d. 
Optimal results are achieved for a displacement vector 
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^(1,0,1,0,1,0), and yield: 
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p = p(100) = p(010) = p(001) = C(a, a) exp I - - ^ 

with coefficients X i = cr 2 + | [3a — \/9a 2 — 8j , = 
a 1 + j [3a + \/9a 2 — 8j , and the prefactor reads: 

i 

7m + 7( a ) 



C (a, a) = 



det 



(5) 



(a - c + cr 2 ) (b + c + ^ + 20 + a 2 ) (&-2c+4,) 



In the approximation a 3> 1 it follows that: 



p=I-lfc + 0(fc 2 ) ; 
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with fc = exp [— 1(^-) 2 ] . The probabilities depend 
from the parameters a, xo and cr, but there exists a 
large region in the parameter space for which p = | 
and <5i — > 0. However, this condition is violated for 
a < a min = indicating that not all pure 3-mode 
symmetric entangled Gaussian states can be used to im- 
plement the W-Flip. Finally, we remark here that imple- 
menting the Q-Flip primitive by selecting those values 
for which \xa\ , \xb\ , \%c\ £ {0,cco} so that each player 
will associate the logical trit to the results of their mea- 
surement according to the following rule q m = 2, 1,0 if 
x m = +xo,0,— xq is not possible. In such case, the ab- 
solute and conditional probabilities never fulfill the re- 
quirements of the Q-Flip primitive. 

We move now to the distribution k, test part of the 
protocol which represents the first step in the execution 
of the W-Flip and has only two possible outputs: global 
success or global failure. In the case of failure a player 
assumes that something went wrong during the execution 
of the protocol and, therefore, he aborts any further ac- 
tion. The players share pairwise secure classical channels 
and secure (noiseless) quantum channels. The basic in- 
gredient to implement a secure distribution & test part, 
is based in the possibility that each player can check cor- 
relations by asking the other participants to send to him 
different random subsets of their systems. In doing so, it 
is possible to detect manipulation of the data on an sta- 
tistical basis and to abort the protocol if necessary. Here 
we focus on demonstrating security and ignore efficiency 
questions [Toj. This part proceeds as follows: 



(1.1) R\ prepares a large number m = 1, 2, . . . , M of sys- 
tems in state 7(a) with dw and sends one subsystem to 
S and another to R . 

(1.2) Ri chooses (randomly) two disjoint sets of indices 
Ki, i e {S, i?o} [Ks n Kji = 0) and send Ki to player i. 
Player i is asked to send his subsystems m £ Ki to player 
j. For each m € Ki, participant j measures the two 
subsystems in his possession while R\ measures his sub- 
system. After communication on their results over secure 
classical channels they agree on those indices Kj C Kj for 
which |:Bj| = \xr ± \ = xq. Ri and j check now whether the 
correlations of the W-Flip occur: pioo = P010 = P001 = 3, 
Pciso = 0. If the test was successful, i.e. if the measure- 
ment results were consistent with the assumption that 
the states have been distributed correctly, the players 
i € {j,Ri} set the flag fi = 1, otherwise fi = 0. In an 
analogous way, the test is performed for S and Rq. 

(1.3) Players S, Rq and R\ send their flags to each other. 
Every player who receives a flag "0", sets his flag also 
to "0" . Every player with flag "0" aborts the protocol. 
Otherwise the execution of the protocol proceeds. This 
step terminates the distribution & test part. 

In the second phase of the protocol a selection of the 
distributed systems is chosen to establish the bit se- 
quences which will be use to implement the W-Flip prim- 
itive. In this phase, again honest parties may abort the 
protocol if malicious manipulations occurs. 
(ii-1) The players S, Rq and R\ agree upon a set of sys- 
tems m G M C M , which have not been discarded during 
the distribution & test part. 

(ii-2) Player S chooses (randomly) two disjoint sets of 
subsystems labeled by indices L l s C M and after sending 
index set L l s to player i demands player i to send his 
subsystems m € L l s to him. In each case, the (random) 
choice L l s is secret to party j, i.e. player R\ has no in- 
formation about the set Lg°. Analogously this step is 
performed for Rq and R±. 

(ii-3) S performs now measurements on subsystems m G 
M— [Lg° +Lg 1 } = Ms- The analogous step is performed 
by the other players i. 

(ii-4): After measuring their whole sequences, player i € 
{S, Ro,R\} now announces publicly, for which m G Mi 
he measured ±xo, represented by an index set M™. The 
order in which the players announce their measurement 
results can be specified initially and based e.g. on a ro- 
tation principle. 

(ii-5) Without loss of generality let us specify this pro- 
tocol step for player S. From the following sets n 
M™ =: Ug 1 and Lf 1 n AI% =: Ug a let E/f 4 C Ug* 
for i S {0, 1} be the index set for which the player 
S measured ±Xq twice. Analogously to the first phase 
of the protocol, player S can test if the output of his 
measures agree with the correlations of a proper W-Flip 
(p(00) = p(10) = p(01) = 1/3 and p(ll) = 0) If the test 
is successful, the player sets his flag f s = 1, otherwise 
fs = 0. Same procedure is analogously performed by Rq 
and Ri. From this step on, players deal exclusively with 
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the outputs of their measures, i.e. classical instruments. 
(ii-6) S checks correlation on his outputs in the following 
set M := M™ n M% n M% C Mg\ If the test is suc- 
cessful, S sets his flag f$ = 1, otherwise /g = 0. i?o and 
i?i do the equivalent step. 

(ii-7): For a randomly chosen set V s C M player S de- 
mands from i? and i?i their measurement results. S 
tests this control sample for the assumed W-Flip hypoth- 
esis. If the test is successful, S sets his flag fg = 1, 
otherwise fs — 0. i?o (Ri) perform this step with a set 
V R ° C Af\P s {V Rl C M\(P S U P fl °)) respectively. 
(ii-8) Every player with a flag aborts the execution of 
the protocol. Otherwise the players agree upon a set 
W := M\(V S U V R ° U V Rl ) as the result of the W-Flip 
invocation, which must contain an even number of ele- 
ments 2L so that a sequence of L Q-flips can be extracted. 
Broadcasting, as described previously by steps (iii) can 
now be implemented. 

It is straightforward to show that the strategy 
implemented by (iii) is secure and, if there is enough 
statistics, the occurrence of the Z-flip can be safely de- 
termined. 

Finally, we have considered two different types of er- 
rors that can occur when implementing the W-flip with 
Gaussian states. The first one is just the error on ob- 
taining a false combination of outputs, i.e. 5i. This error 
will propagate in the Q and Z-flips so that the proba- 
bility of finding a combination which is not appropriate 
is bounded from above from 77 = 1 — (3p) 2 . The sec- 
ond source of "errors" are malicious manipulations. In 
order to manipulate the measurement results of other 
players, player i could shift the local component of the 
displacement vector of the distributed state using local 
transformations. Notice that a shift on xq is equivalent 
to a shift on one of the components of displacement vec- 
tor. That means that both kind of manipulations re- 
sult on the same change of probabilities for a given out- 
put calculated by the overlap (see EqOJ). Parameterizing 
the shift in the displacement vector by the parameter K, 

Ww=rf (i,o,i,o,k,o) 

Thus player i could determine via subsequent commu- 



nication with the other players (step ii.4) with certain 
probability, the occurrence of the outputs of the other 
players thereby gain additional information. In con- 
trast, direct measurement of a local manipulation with- 
out classical communication between i and j is impossi- 
ble. This can be seen by realizing that the partial trace 
Tr c (p( 7 ,d')) = JWab (£ab) = Tr c (p( 7 ,d)) with 
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A possible strategy for the traitor could consist of the 
following points: (i) Discrediting honest players by ma- 
nipulating the displacement vector in such a way that 
non consistent combinations appear, (ii) to hide success- 
ful measurements to the honest players which result in 
combinations that might be disadvantageous. However, 
one can detect the effects of such manipulations by the 
test steps proposed in (ii-5)-(ii.7)[Tlj. 

To summarize, we have proposed an algorithm to solve 
detectable broadcast with continuous variables, i.e. us- 
ing Gaussian states and Gaussian operations only. To 
the best of our knowledge this is the first truly "multi- 
partite" algorithm for continous variables. Moreover, it 
can be straightfowdarly adapted to the discrete case by 
using 3 partite W-states[14j which presently are already 
created in ion traps |l5j. Finally, we have shown that al- 
though entanglement is needed to solve the problem not 
all entangled symmetric states can be used for this pur- 
pose and we have found a lower bound on the amount of 
entanglement required^]. 
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